audit: fix oops removing watch if audit disabled

7b018b28 · Tony Jones <[email protected]> · 2007-06-23 17:16:47 -07:00

Removing a watched file will oops if audit is disabled (auditctl -e 0).

To reproduce:
- auditctl -e 1
- touch /tmp/foo
- auditctl -w /tmp/foo
- auditctl -e 0
- rm /tmp/foo (or mv)

Signed-off-by: Tony Jones <[email protected]>
Cc: Al Viro <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: 7b018b2888b32284e09bba9cccb5cd2e12199feb
Parents: 266f5aa0

Changes

1 files changed · +1 −1

File	Status	Add	Del	Content
kernel/auditfilter.c	modified	+1	−1	View file

kernel/auditfilter.c

View file

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 74cc0fc..ce61f42 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -947,7 +947,7 @@ static void audit_update_watch(struct audit_parent *parent,
 
 		/* If the update involves invalidating rules, do the inode-based
 		 * filtering now, so we don't omit records. */
-		if (invalidating &&
+		if (invalidating && current->audit_context &&
 		    audit_filter_inodes(current, current->audit_context) == AUDIT_RECORD_CONTEXT)
 			audit_set_auditable(current->audit_context);
 